March 15, 2009

Internet Security: Are we losing to "Malware 2.0"?

Have you noticed an increase in Internet threats and "noise" lately? It seems like there has been a surge of malicious activity on the web in recent months. Since I wrote the post about the AdSense DoubleClick tracking cookie a few days ago, I have come across quite a bit of recent unusual activity related to malware and Internet security - the Google DoubleClick network itself has recently shown malware on multiple publisher sites.

Google responded by blocking the sites - not just the ads - and displaying a blatant "This site contains malware" warning to visitors. This decreases the publisher's reputation and costs the publisher time, money, and customers - but keeps Google looking like the hero that responded quickly to an outside threat...

A Google spokesman said: "Our scanners have found a few instances of these malware ads in the DoubleClick network. As such, we've added these domains to our malware list and are in the process of removing any offending ads from our ad network."
- From The Register - DoubleClick distributes malware (emphasis mine)

It seems to me that many recent hacks and threats exploit the things we all like about Web 2.0:
  • it's connected
  • it's fast
  • it's everywhere
  • it's personal, and
  • it's always on
This is troublesome, because it is practically impossible to continuously monitor all of the data aggregated, repeated, mashed up, linked, regurgitated, and spewed into the massive expanse that is the Internet through new applications and websites by new people and robots every hour.
Here are just a few examples of recent web 2.0 threats and other Internet incidents:
I think the scariest part is this:

" new malware variants introduced in the Top 10 for two consecutive months."
- Pro Security Zone, based on Fortinet threatscape report. Super-Worm emerges in Fortinet threatscape report for February

combined with this:

"BitDefender’s list of top threats for February dominated by the drive-by variant of malware activated during website visits"
- Pro Security, based on BitDefender's threat list: Auto-downloads dominate February threat list

Basically, in addition to the usual email, file, download, and popup malware you now must watch out for auto-download attacks and malware that "activates" when you visit a reputable site, look at AdSense or Doubleclick ads, Twitter, Facebook, or simply open your browser.

It might be time to slow down, Internet (especially Web 2.0). We are developing applications too fast. We are neglecting Internet security and online privacy to a point that it is getting difficult to tune out the Internet "background noise" and focus on productivity. We would rather give the users the fully connected always-logged-in remember-me target-my-ads ooh-thats-pretty just-tell-me-where-to-click Internet.

I think we should step back, re-examine user goals, and clean up the junk floating around in the World Wide Web.

How to (hopefully, maybe, sometimes) stop popups, trojans, worms, and other malware while surfing:
  • Get a good virus scanner and spyware blocker
  • Run full scans regularly
  • Keep your operating system, browser, and all other programs up to date
  • Turn your computer off regularly
  • Never allow sites to keep you logged in, remember your password, or log you in to any other site
  • Clean up your temporary files, and remove as many unused programs and links as possible
  • Check your system files and folders, as well as running processes regularly. Know what should be there so you will quickly see when something is wrong
  • Do not assume https is safe
  • Avoid typing your Bank account, Routing, Credit Card, Driver License, Social Security Number, or any other "severly identifying" information into a text box, form, widget, email, chat, or any other application online or even on your computer as much as possible
  • Use safe surfing browser extensions like AdBlock Plus for Firefox
  • Observe symptoms and get help if your computer or browser does something suspicious or unusual
  • Regularly check security sites such as those linked in this post for threats
  • Use Scroogle to search
  • Use Privacy Choice to opt out of all ad networks
  • Clear your cache and cookies when you close your browser, and manually after you see ads
  • Consider disabling cookies altogether, along with JavaScript and all popups.
  • Block ads using your hosts file. Doing this sets the "location" of each ad network in the list to your local computer, so you will only see errors instead of ads from those providers, and never connect to them (note: some malware modifies the hosts file, circumventing this protection). This technique allows you to allow some ads if you choose. Here is a regularly updated ad-blocking hosts file in plain text. Try to avoid the ones that want you to download a .bat file or other executable. Your hosts file is usually in C:\Windows\System32\drivers\etc in Windows XP and has no extension. Back it up before changing or overwriting!
  • In general, never ever ever download files with funny names, lots of special characters, and never run a program from the Internet
  • Similarly, never ever pass things on to your whole contact list, reply to chain letters or forwarded mail, or click anything even slightly suspicious
  • Most importantly, think before you click!

Please add your thoughts, ideas, questions, or comments below.


  1. Also you forgot to mention that today's hacker's arer a little more skilled than those from back in the day...

  2. Funny you mention that - I actually just watched a video yesterday showing that about half of the most common "hacks" on the Internet could be done by a 7 year old (I was surprised also). Most are legal, and some are even within the "terms of service" - they exploit flaws in business logic rather than your database.

    People just don't care to pay attention, everyone wants what is fastest and most convenient, no matter how detrimental the result may be. Instant gratification - electricity, drugs, credit, Web 2.0, it's all the same. We all just need to take a step back and slow down. We are quite literally "getting ahead of ourselves".


Please enter some legible and hopefully relevant text: